[Bobbi Flekman]

Hi Bobbi,

I think I got the file you wanted to see uploaded in the bleeping forum.

I loaded ZA and it is giving me grief. so much to keep an eye on using this...ignorance is bliss with the Micro firewall...

Thanks Ruth

Thanks... I'll check out the file... As far as Zone Alarm is concerned. You can tell it to remember the answer you give. After a while you will get no questions asked anymore

[Advertisements]

Hey Ruth,

I looked at the file, and to me it looks like a log file from some sort of web server, or backdoor.

I PM'd you... If this is personal data, I don't want to spread it out on the net

[Bobbi Flekman]

Hey Ruth,

I looked at the file, and to me it looks like a log file from some sort of web server, or backdoor.

I PM'd you... If this is personal data, I don't want to spread it out on the net

[Bobbi Flekman]

Hi Ruth,

as said in PM this is generic fix for this infection.

Launch Notepad, and copy/paste the box below into a new text file. Save it as fixme.reg and save it on your Desktop.

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Srv32Win"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs]
"C:\%Windir%\unvise32.exe"=-

[-KEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\KeyCaptor]

Locate fixme.reg on your Desktop and double-click on it.
You will receive a prompt similar to: "Do you wish to merge the information into the registry?".
Answer "Yes" and wait for a message to appear similar to "Merged Successfully".

The above Registry file was written specifically for this infection on this person's computer. It is NOT to be used on another computer, as it may cause damage that could result in a format!

Delete the following files in red (it could be that they are deleted already):

C:\WINNT\kcopts.dat
C:\WINNT\NTInvisible.dll
C:\WINNT\SystemSA32.dll
C:\WINNT\unvise32.exe
C:\WINNT\spysplash.dat

Delete the following folders in red (it could be that they are deleted already):

C:\Program Files\KeyCaptor
C:\Documents And Settings\Ruth\Start Menu\Programs\Keycaptor

Can you post a log from SpywareDoctor and HijackThis after this. Thanks.

[Kat]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.